Free DISA STIG and SRG Library | Vaulted

Vulnerabilities (148)

First Run Wizard settings must be established for a home page.

Finding ID
DTBI010-IE11
Rule ID
SV-59335r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI010-IE11 - Prevent performance of First Run Customize setting
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting prevents Internet Explorer from running the First Run Wizard the first time a user starts the browser after installing Internet Explorer or Windows. If this policy setting is enabled, IE is configurable in two ways: 1) Skip the First Run Wizard, and go directly to the user's home page, or 2) Skip the First Run Wizard, and go directly to the "Welcome to Internet Explorer" web page. If this policy setting is disabled or not configured, Internet Explorer may run the First Run Wizard the first time the browser is started after installation and provide users the ability to configure IE outside of environment policy. Starting with Windows 8, the "Welcome to Internet Explorer" web page is not available. The user's home page will display regardless of which option is chosen.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent running First Run Wizard" to "Enabled", and select "Go directly to home page" from the drop-down box.

Check Content

PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

The Internet Explorer warning about certificate address mismatch must be enforced.

Finding ID
DTBI015-IE11
Rule ID
SV-59339r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI015-IE11- IE Warning of invalid certificates
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page "Turn on certificate address mismatch warning" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Download signed ActiveX controls property must be disallowed (Internet zone).

Finding ID
DTBI022-IE11
Rule ID
SV-59345r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI022-IE11 - Download signed ActiveX - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by untrusted publishers. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download signed ActiveX controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

DownloadSignedActiveXControls_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Download unsigned ActiveX controls property must be disallowed (Internet zone).

Finding ID
DTBI023-IE11
Rule ID
SV-59347r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI023-IE11 - Download unsigned ActiveX - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run. If you disable this policy setting, users cannot run unsigned controls. If you do not configure this policy setting, users cannot run unsigned controls.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Download unsigned ActiveX controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).

Finding ID
DTBI024-IE11
Rule ID
SV-59365r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI024-IE11 - Initialize and script ActiveX - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Initialize and script ActiveX controls not marked as safe" to "Enabled", and select "Disable" from the drop-down box.

Check Content

InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Font downloads must be disallowed (Internet zone).

Finding ID
DTBI030-IE11
Rule ID
SV-59369r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI030-IE11- Font download control - Internet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Downloads of fonts can sometimes contain malicious code. It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download. If you disable this policy setting, HTML fonts are prevented from downloading.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow font downloads" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowFontDownloads_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Java permissions must be disallowed (Internet zone).

Finding ID
DTBI031-IE11
Rule ID
SV-59371r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI031-IE11 - Java Permission - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

DCMC-1

Accessing data sources across domains must be disallowed (Internet zone).

Finding ID
DTBI032-IE11
Rule ID
SV-59373r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI032-IE11 - Data sources across domains - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Access data sources across domains" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Functionality to drag and drop or copy and paste files must be disallowed (Internet zone).

Finding ID
DTBI036-IE11
Rule ID
SV-59375r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI036-IE11 -Drag and drop or copy and paste-Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow drag and drop or copy and paste files" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Launching programs and files in IFRAME must be disallowed (Internet zone).

Finding ID
DTBI038-IE11
Rule ID
SV-59377r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI038-IE11 - Programs and files in IFRAME - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Launching applications and files in an IFRAME" to "Enabled", and select "Disable" from the drop-down box.

Check Content

LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Navigating windows and frames across different domains must be disallowed (Internet zone).

Finding ID
DTBI039-IE11
Rule ID
SV-59379r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI039-IE11 - Navigating across domains - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross site scripting. This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Navigate windows and frames across different domains" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Userdata persistence must be disallowed (Internet zone).

Finding ID
DTBI042-IE11
Rule ID
SV-59381r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI042-IE11 - Userdata persistence - Internet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Userdata persistence must have level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against visitors browsing the site. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Userdata persistence" to "Enabled", and select "Disable" from the drop-down box.

Check Content

UserdataPersistence_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Clipboard operations via script must be disallowed (Internet zone).

Finding ID
DTBI044-IE11
Rule ID
SV-59385r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI044-IE11 - Paste operations via script - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have level of protection based upon the site being accessed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow cut, copy or paste operations from the clipboard via script" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Logon options must be configured to prompt (Internet zone).

Finding ID
DTBI046-IE11
Rule ID
SV-59387r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI046-IE11 - User Authentication-Logon - Internet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”, but configuring this setting to “Enabled”; “Prompt for user name and password”, provides a reasonable balance between security and usability.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Logon options" to "Enabled", and select "Prompt for user name and password" from the drop-down box.

Check Content

LogonOptions_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Java permissions must be configured with High Safety (Intranet zone).

Finding ID
DTBI061-IE11
Rule ID
SV-59389r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI061-IE11 - Java Permission - Intranet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> "Java permissions" to "Enabled", and select "High Safety" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be configured with High Safety (Trusted Sites zone).

Finding ID
DTBI091-IE11
Rule ID
SV-59407r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI091-IE11 - Java Permission - Trusted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> "Java permissions" to "Enabled", and select "High Safety" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

DCMC-1

Dragging of content from different domains within a window must be disallowed (Internet zone).

Finding ID
DTBI1000-E11
Rule ID
SV-59409r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1000-E11 - Content from different domains within windows - Internet zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone "Enable dragging of content from different domains within a window" to "Enabled", and select "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Dragging of content from different domains across windows must be disallowed (Restricted Sites zone).

Finding ID
DTBI1005-E11
Rule ID
SV-59411r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1005-E11 - Content from different domains across windows - Restricted zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you enable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone "Enable dragging of content from different domains across windows" to "Enabled", and select "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer).

Finding ID
DTBI1010-E11
Rule ID
SV-59413r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1010-E11 - Restrict ActiveX Install - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes Restrict ActiveX Install must be enforced (IExplore).

Finding ID
DTBI1020-E11
Rule ID
SV-59417r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1020-E11 - Restrict ActiveX Install - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Dragging of content from different domains within a window must be disallowed (Restricted Sites zone).

Finding ID
DTBI1025-E11
Rule ID
SV-59419r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1025-E11 - Content from different domains within windows - Restricted zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone "Enable dragging of content from different domains within a window" to "Enabled", and select "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

URL Suggestions must be disallowed.

Finding ID
DTBI1030-E11
Rule ID
SV-59421r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1030-E11 - URL Suggestions
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting turns off URL Suggestions. URL Suggestions allow users to auto complete URLs in the address bar based on common URLs. The list of common URLs is stored locally and is updated once a month. No user data is sent over the internet by this feature. If you enable this policy setting, URL Suggestions will be turned off. Users will not be able to turn on URL Suggestions. If you disable this policy setting, URL Suggestions will be turned on. Users will not be able to turn off URL Suggestions. If you do not configure this policy setting, URL Suggestions will be turned on. Users will be able to turn on or turn off URL Suggestions in the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Settings-> AutoComplete "Turn off URL Suggestions" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Displaying of the reveal password button must be disallowed.

Finding ID
DTBI1035-E11
Rule ID
SV-59423r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1035-E11 - Displaying of the reveal password button
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to hide the reveal password button when Internet Explorer prompts users for a password. The reveal password button is displayed during password entry. When the user clicks the button, the current password value is visible until the mouse button is released (or until the tap ends). If you enable this policy setting, the reveal password button will be hidden for all password fields. Users and developers will not be able to depend on the reveal password button being displayed in any web form or web application. If you disable or do not configure this policy setting, the reveal password button can be shown by the application as a user types in a password. *Note: On at least Windows 8, if the "Do not display the reveal password button" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Credential User Interface is enabled for the system, it will override this policy setting.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Security Features "Do not display the reveal password button" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Do Not Track header must be sent.

Finding ID
DTBI1040-E11
Rule ID
SV-59427r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1040-E11 - Tracking of Headers
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to configure how Internet Explorer sends the Do Not Track (DNT) header. If you enable this policy setting, Internet Explorer sends the DNT:1 header on all HTTP and HTTPS requests. The DNT:1 header signals that servers should not track the user. If you disable this policy setting, Internet Explorer sends the DNT:1 header only when a Tracking Protection List is enabled, or when InPrivate Browsing mode is used. If you do not configure this policy setting, users can select the Always send Do Not Track header options on the Advanced tab of the Internet Options dialog box. When this option is selected, Internet Explorer sends the DNT:1 header on all HTTP and HTTPS requests.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page "Always send Do Not Track header" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Legacy filter functionality must be disallowed (Internet zone).

Finding ID
DTBI1045-E11
Rule ID
SV-59429r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1045-E11 - Legacy filters (Internet zone).
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting specifies whether Internet Explorer renders legacy visual filters in this zone. If you enable this policy setting, you can control whether or not Internet Explorer renders legacy filters by selecting Enable, or Disable under Options in Group Policy Editor. If you disable, or do not configure this policy setting, users can choose whether or not to render filters in this zone. Users can change this setting on the Security tab of the Internet Options dialog box. Filters are not rendered by default in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone "Render Legacy Filters" to "Enabled", and select "Disable".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Legacy filter functionality must be disallowed (Restricted Sites zone).

Finding ID
DTBI1050-E11
Rule ID
SV-59433r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1050-E11 - Legacy filters (Restricted Sites zone).
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting specifies whether Internet Explorer renders legacy visual filters in this zone. If you enable this policy setting, you can control whether or not Internet Explorer renders legacy filters by selecting Enable, or Disable under Options in Group Policy Editor. If you disable, or do not configure this policy setting, users can choose whether or not to render filters in this zone. Users can change this setting on the Security tab of the Internet Options dialog box. Filters are not rendered by default in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone "Render Legacy Filters" to "Enabled", and select "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer accelerator functionality must be disallowed.

Finding ID
DTBI1055-E11
Rule ID
SV-59435r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1055-E11 - Internet Explorer Accelerator
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Internet Explorer Accelerator feature is for use with third-party applications and toolbars. This policy setting allows you to manage whether users can access accelerators. If you enable this policy setting, users cannot access accelerators. If you disable or do not configure this policy setting, users can access accelerators and install new accelerators.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Accelerators "Turn off Accelerators" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The Download signed ActiveX controls property must be disallowed (Restricted Sites zone).

Finding ID
DTBI112-IE11
Rule ID
SV-59437r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI112-IE11 - Download signed ActiveX - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download signed ActiveX controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone).

Finding ID
DTBI113-IE11
Rule ID
SV-59439r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI113-IE11 - Download unsigned ActiveX - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. They must also be digitally signed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Download unsigned ActiveX controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone).

Finding ID
DTBI114-IE11
Rule ID
SV-59441r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI114-IE11 - Initialize and script ActiveX-Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Initialize and script ActiveX controls not marked as safe" to "Enabled", and select "Disable" from the drop-down box.

Check Content

InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).

Finding ID
DTBI115-IE11
Rule ID
SV-59443r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI115-IE11 - ActiveX control and plugins - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run without user intervention. If you disable this policy setting, controls and plug-ins are prevented from running.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run ActiveX controls and plugins" to "Enabled", and select "Disable" from the drop-down box.

Check Content

RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone).

Finding ID
DTBI116-IE11
Rule ID
SV-59445r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI116-IE11 - ActiveX control marked safe - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Script ActiveX controls marked safe for scripting" to "Enabled", and select "Disable" from the drop-down box.

Check Content

ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

File downloads must be disallowed (Restricted Sites zone).

Finding ID
DTBI119-IE1
Rule ID
SV-59447r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI119-IE11 - File download control - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow file downloads" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowFileDownloads_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Font downloads must be disallowed (Restricted Sites zone).

Finding ID
DTBI120-IE11
Rule ID
SV-59449r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI120-IE11 - Font download control - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. Downloads of fonts can sometimes contain malicious code. Files should not be downloaded from restricted sites. This policy setting allows you to manage whether pages of the zone may download HTML fonts.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow font downloads" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowFontDownloads_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Restricted Sites zone).

Finding ID
DTBI121-IE11
Rule ID
SV-59451r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI121-IE11 - Java Permission - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

JavaPermissions_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Accessing data sources across domains must be disallowed (Restricted Sites zone).

Finding ID
DTBI122-IE11
Rule ID
SV-59453r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI122-IE11 - Access data sources - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Access data sources across domains" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

The Allow META REFRESH property must be disallowed (Restricted Sites zone).

Finding ID
DTBI123-IE11
Rule ID
SV-59455r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI123-IE11 - META REFRESH - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

It is possible that users will unknowingly be redirected to a site hosting malicious content. "Allow META REFRESH" must have a level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redirected to another web page if the author of the web page uses the Meta Refresh setting to redirect browsers to another web page.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow META REFRESH" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone).

Finding ID
DTBI126-IE11
Rule ID
SV-59457r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI126-IE11 - Drag and drop or copy and paste-Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow drag and drop or copy and paste files" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Installation of desktop items must be disallowed (Restricted Sites zone).

Finding ID
DTBI127-IE11
Rule ID
SV-59459r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI127-IE11 - Installation of desktop items - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Active Desktop items could contain links to unauthorized websites or other undesirable content. It is prudent to prevent users from installing desktop items from this security zone. Installation of items must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether users can install Active Desktop items from this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow installation of desktop items" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Launching programs and files in IFRAME must be disallowed (Restricted Sites zone).

Finding ID
DTBI128-IE11
Rule ID
SV-59461r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI128-IE11 - Programs and files in IFRAME-Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Launching applications and files in an IFRAME" to "Enabled", and select "Disable" from the drop-down box.

Check Content

LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Navigating windows and frames across different domains must be disallowed (Restricted Sites zone).

Finding ID
DTBI129-IE11
Rule ID
SV-59463r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI129-IE11 - Navigating across domains - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross site scripting. This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Navigate windows and frames across different domains" to "Enabled", and select "Disable" from the drop-down box.

Check Content

NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Rule Title: Userdata persistence must be disallowed (Restricted Sites zone).

Finding ID
DTBI132-IE11
Rule ID
SV-59465r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI132-IE11- Userdata persistence - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Userdata persistence" to "Enabled", and select "Disable" from the drop-down box

Check Content

UserdataPersistence_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Active scripting must be disallowed (Restricted Sites Zone).

Finding ID
DTBI133-IE11
Rule ID
SV-59467r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI133-IE11- Active scripting - Restricted Sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in the zone are run.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow active scripting" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowActiveScripting_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Clipboard operations via script must be disallowed (Restricted Sites zone).

Finding ID
DTBI134-IE11
Rule ID
SV-59469r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI134-IE11 - Paste operations via script - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have level of protection based upon the site being accessed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow cut, copy or paste operations from the clipboard via script" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Logon options must be configured and enforced (Restricted Sites zone).

Finding ID
DTBI136-IE11
Rule ID
SV-59471r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI136-IE11 - User Authentication - Logon - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”. This will prevent users from submitting credentials to servers in this security zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Logon options" to "Enabled", and select "Anonymous logon" from the drop-down box.

Check Content

LogonOptions_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Configuring History setting must be set to 40 days.

Finding ID
DTBI300-IE11
Rule ID
SV-59473r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI300-IE11 - Configuring History lists
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, General tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. The number of days that Internet Explorer keeps track of the pages viewed in the History List must be specified. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> "Disable Configuring History" to "Enabled", and enter "40" in 'Days to keep pages in History'.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Automatic configuration of Internet Explorer connections must be disallowed.

Finding ID
DTBI305-IE11
Rule ID
SV-59475r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI305-IE11 - Automatic configuration is not disabled
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet Explorer use the configuration settings provided in a file by the system administrator. If you enable this policy setting, the user will not be able to do automatic configuration. You can import current connection settings using Internet Explorer Maintenance under Admin Templates using group policy editor. If you disable or do not configure this policy setting, the user will have the freedom to automatically configure these settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Disable changing Automatic Configuration settings" to "Enabled".

Check Content

DisableChangingAutomaticConfigurationSettings_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Participation in the Customer Experience Improvement Program must be disallowed.

Finding ID
DTBI315-IE11
Rule ID
SV-59477r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI315-IE11 - Customer Experience Improvement Pgm
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications. When users choose to participate in the Customer Experience Improvement Program (CEIP), applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and to improve the products and features customers use most often. This feature does not collect users' names, addresses, or any other identifying information except the IP address that is used to send the data. By default, users have the opportunity to opt into participation in the CEIP the first time they run an application. If an organization has policies that govern the use of external resources such as the CEIP, allowing users to opt in to the program might cause them to violate these policies.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Prevent participation in the Customer Experience Improvement Program" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer must be set to disallow users to add/delete sites.

Finding ID
DTBI318-IE11
Rule ID
SV-59479r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI318-IE11 - Addition and deletion of sites
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will be able to add or remove sites from the Trusted Sites and Restricted Sites zones at will and change settings in the Local Intranet zone. This configuration could allow sites that host malicious mobile code to be added to these zones, and users could execute the code.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer "Security Zones: Do not allow users to add/delete sites" to "Enabled".

Check Content

DoNotAllowUsersAddDeleteSites_LocalComputer_var

Responsibility

System Administrator

Third Party Tools

HK

IA Controls

ECSC-1

Internet Explorer must be configured to disallow users to change policies.

Finding ID
DTBI319-IE11
Rule ID
SV-59481r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI319-IE11 - Changing of policies
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by administrators only, so this setting should be enabled. If you enable this policy setting, you disable the Custom level button and Security level for this zone slider on the Security tab in the Internet Options dialog box. If this policy setting is disabled or not configured, users will be able to change the settings for security zones. It prevents users from changing security zone policy settings that are established by the administrator.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer "Security Zones: Do not allow users to change policies" to "Enabled".

Check Content

DoNotAllowUsersChangePolicies_LocalComputer_var

Responsibility

System Administrator

Third Party Tools

HK

IA Controls

ECSC-1

Internet Explorer must be configured to use machine settings.

Finding ID
DTBI320-IE11
Rule ID
SV-59483r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI320-IE11 - Security zone machine settings
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to all users of the computer. Security zones control browser behavior at various websites and it is desirable to maintain a consistent policy for all users of a machine. This policy setting affects how security zone changes apply to different users. If you enable this policy setting, changes that one user makes to a security zone will apply to all users of that computer. If this policy setting is disabled or not configured, users of the same computer are allowed to establish their own security zone settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer "Security Zones: Use only machine settings" to "Enabled".

Check Content

UseOnlyMachineSettings_LocalComputer_var

Responsibility

System Administrator

Third Party Tools

HK

IA Controls

ECSC-1

Security checking features must be enforced.

Finding ID
DTBI325-IE11
Rule ID
SV-59485r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI325-IE11 - Security settings check feature
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off the Security Settings Check feature" to "Disabled".

Check Content

TurnOffSecuritySettingsCheckFeature_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Active content from CDs must be disallowed to run on user machines.

Finding ID
DTBI340-IE11
Rule ID
SV-59487r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI340-IE11 - Active content from CD's
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. If you disable this policy setting, active content on a CD will always prompt before running. If you do not configure this policy, users can choose whether to be prompted before running active content on a CD.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow active content from CDs to run on user machines" to "Disabled".

Check Content

Allow Active Content from CDs to Run on User Machine - Local Computer - variable

Responsibility

System Administrator

IA Controls

ECSC-1

Software must be disallowed to run or install with invalid signatures.

Finding ID
DTBI350-IE11
Rule ID
SV-59489r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI350-IE11 - Software with invalid signatures
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can positively identify the signer to determine whether you trust them enough to run their software. The validity of unsigned code cannot be ascertained. Some legitimate software and controls may have an invalid signature. You should carefully test such software in isolation before it is allowed to be used on an organization's network.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow software to run or install even if the signature is invalid" to "Disabled".

Check Content

Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable

Responsibility

System Administrator

IA Controls

DCMC-1

Third-party browser extensions must be disallowed.

Finding ID
DTBI355-IE11
Rule ID
SV-59491r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI355-IE11 - Third-party browser extensions
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether Internet Explorer will launch COM add-ons, known as browser helper objects such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability. If you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer. If you disable this policy setting, browser helper objects do not launch. If you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Allow third-party browser extensions" to "Disabled".

Check Content

Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable

Responsibility

System Administrator

IA Controls

ECSC-1

Checking for server certificate revocation must be enforced.

Finding ID
DTBI365-IE11
Rule ID
SV-59493r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI365-IE11 - Check for server certificate revocation
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for server certificate revocation" to "Enabled".

Check Content

Check for Server Certificate Revocation - Local Computer - variable

Responsibility

System Administrator

IA Controls

IATS-1, IATS-2

Internet Explorer must be configured to make proxy settings per user.

Finding ID
DTBI367-IE11
Rule ID
SV-59495r1_rule
Severity
Cat III
CCE
(None)
Group Title
DTBI367-IE11 - Proxy settings
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis. If you enable this policy, users cannot set user specific proxy settings. They must use the zones created for all users of the computer. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings. This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer "Make proxy settings per-machine (rather than per user)" to "Disabled".

Check Content

MakeProxySettingsPerMachine_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Checking for signatures on downloaded programs must be enforced.

Finding ID
DTBI370-IE11
Rule ID
SV-59497r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI370-IE11 - Signature checking - downloaded programs
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> "Check for signatures on downloaded programs" to "Enabled".

Check Content

Check for Signature on Downloaded Programs - Local Computer - variable

Responsibility

System Administrator

IA Controls

ECSC-1

All network paths (UNCs) for Intranet sites must be disallowed.

Finding ID
DTBI375-IE11
Rule ID
SV-59499r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI375-IE11 - Network paths (UNC's) - Intranet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> "Intranet Sites: Include all network paths (UNCs)" to "Disabled".

Check Content

IncludeAllNetworkPaths_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Script-initiated windows without size or position constraints must be disallowed (Internet zone).

Finding ID
DTBI385-IE11
Rule ID
SV-59501r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI385-IE11 - Script initiated windows - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow script-initiated windows without size or position constraints" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).

Finding ID
DTBI390-IE11
Rule ID
SV-59503r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI390-IE11 - Script initiated windows - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow script-initiated windows without size or position constraints" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Scriptlets must be disallowed (Internet zone).

Finding ID
DTBI395-IE11
Rule ID
SV-59505r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI395-IE11 - Scriptlets - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow Scriptlets" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptlets_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Automatic prompting for file downloads must be disallowed (Internet zone).

Finding ID
DTBI415-IE11
Rule ID
SV-59507r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI415-IE11 - Prompt for file downloads - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Automatic prompting for file downloads" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Java permissions must be disallowed (Local Machine zone).

Finding ID
DTBI425-IE11
Rule ID
SV-59509r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI425-IE11 - Java permission - Local Machine
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> "Java permissions" to "Enabled", and "Disable Java" selected from the drop-down box.

Check Content

JavaPermissions_LocalMachineZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Locked Down Local Machine zone).

Finding ID
DTBI430-IE11
Rule ID
SV-59511r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI430-IE11 - Java permission - Locked Down Machine
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Locked Down Intranet zone).

Finding ID
DTBI435-IE11
Rule ID
SV-59513r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI435-IE11 - Java permission - Locked Down Intranet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

JavaPermissions_LockedDownIntranetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Locked Down Trusted Sites zone).

Finding ID
DTBI440-IE11
Rule ID
SV-59517r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI440-IE11 - Java permission - Locked Down Trusted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Locked Down Internet zone).

Finding ID
DTBI445-IE11
Rule ID
SV-59525r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI445-IE11 - Java permission - Locked Down Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Internet Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

todo - description needed

Responsibility

System Administrator

IA Controls

DCMC-1

Java permissions must be disallowed (Locked Down Restricted Sites zone).

Finding ID
DTBI450-IE11
Rule ID
SV-59527r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI450-IE11 - Java permission - Locked Down Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of Custom will control permissions settings individually. Use of Low Safety enables applets to perform all operations. Use of Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. Use of High Safety enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> "Java permissions" to "Enabled", and select "Disable Java" from the drop-down box.

Check Content

JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

DCMC-1

XAML files must be disallowed (Internet zone).

Finding ID
DTBI455-IE11
Rule ID
SV-59529r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI455-IE11 - Loose XAML files - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow loading of XAML files" to "Enabled", and select "Disable" from the drop-down box.

Check Content

LooseXAMLFiles_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

XAML files must be disallowed (Restricted Sites zone).

Finding ID
DTBI460-IE11
Rule ID
SV-59533r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI460-IE11 - Loose XAML files - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow loading of XAML files" to "Enabled", and select "Disable" from the drop-down box.

Check Content

LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

MIME sniffing must be disallowed (Internet zone).

Finding ID
DTBI465-IE11
Rule ID
SV-59537r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI465-IE11 - MIME sniffing - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Enable MIME Sniffing" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

MIME sniffing must be disallowed (Restricted Sites zone).

Finding ID
DTBI470-IE11
Rule ID
SV-59539r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI470-IE11 - MIME sniffing - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature. If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Enable MIME Sniffing" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

First-Run prompt ability must be disallowed (Internet zone).

Finding ID
DTBI475-IE11
Rule ID
SV-59541r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI475-IE11 - First-Run Opt-In - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn off first-run prompt" to "Enabled", and select "Disable" from the drop-down box.

Check Content

todo - description needed

Responsibility

System Administrator

IA Controls

ECSC-1

First-Run prompt ability must be disallowed (Restricted Sites zone).

Finding ID
DTBI480-IE11
Rule ID
SV-59543r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI480-IE11 - First-Run Opt-In - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control. This feature determines if the user gets the prompt or not. If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone. If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone. If you do not configure this policy setting, the first-run prompt is turned off by default.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn off first-run prompt" to "Enabled", and select "Disable" from the drop-down box.

Check Content

TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Protected Mode must be enforced (Internet zone).

Finding ID
DTBI485-IE11
Rule ID
SV-59545r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI485-IE11 - Protected Mode - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn on Protected Mode" to "Enabled", and select "Enable" from the drop-down box.

Check Content

todo - description needed

Responsibility

System Administrator

IA Controls

ECSC-1

Protected Mode must be enforced (Restricted Sites zone).

Finding ID
DTBI490-IE11
Rule ID
SV-59549r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI490-IE11 - Protected Mode - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode. If you do not configure this policy, users will be able to turn on or off protected mode.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn on Protected Mode" to "Enabled" and select "Enable", from the drop-down box.

Check Content

todo - description needed

Responsibility

System Administrator

IA Controls

ECSC-1

Pop-up Blocker must be enforced (Internet zone).

Finding ID
DTBI495-IE11
Rule ID
SV-59553r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI495-IE11 - Pop-up Blocker - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Use Pop-up Blocker" to "Enabled", and select "Enable" from the drop-down box.

Check Content

UsePop-upBlocker_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Pop-up Blocker must be enforced (Restricted Sites zone).

Finding ID
DTBI500-IE11
Rule ID
SV-59555r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI500-IE11 - Pop-up Blocker - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Use Pop-up Blocker" to "Enabled", and select "Enable" from the drop-down box.

Check Content

UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Websites in less privileged web content zones must be prevented from navigating into the Internet zone.

Finding ID
DTBI515-IE11
Rule ID
SV-59557r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI515-IE11 - Less privileged web content - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If Prompt is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Web sites in less privileged Web content zones can navigate into this zone" to "Enabled", and select "Disable" from the drop-down box.

Check Content

WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone.

Finding ID
DTBI520-IE11
Rule ID
SV-59559r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI520-IE11 - Less privileged web content - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If Prompt is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Web sites in less privileged Web content zones can navigate into this zone" to "Enabled", and select "Disable" from the drop-down box.

Check Content

WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Allow binary and script behaviors must be disallowed (Restricted Sites zone).

Finding ID
DTBI575-IE11
Rule ID
SV-59565r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI575-IE11 - Binary and script behaviors - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow binary and script behaviors" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Automatic prompting for file downloads must be disallowed (Restricted Sites zone).

Finding ID
DTBI580-IE11
Rule ID
SV-59569r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI580-IE11 - Prompt for file downloads - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Automatic prompting for file downloads" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME handling is not enabled. (Reserved)

Finding ID
DTBI590-IE11
Rule ID
SV-59573r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI590-IE11 - MIME handling - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME handling must be enforced (Explorer).

Finding ID
DTBI592-IE11
Rule ID
SV-59575r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI592-IE11 - MIME handling - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to the organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME handling must be enforced (IExplore).

Finding ID
DTBI594-IE11
Rule ID
SV-59577r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI594-IE11 - MIME handling - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME sniffing must be enforced (Reserved).

Finding ID
DTBI595-IE11
Rule ID
SV-59579r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI595-IE11 - MIME sniffing - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME sniffing must be enforced (Explorer).

Finding ID
DTBI596-IE11
Rule ID
SV-59581r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI596-IE11 - MIME sniffing - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MIME sniffing must be enforced (IExplore).

Finding ID
DTBI597-IE11
Rule ID
SV-59583r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI597-IE11 - MIME sniffing - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MK protocol must be enforced (Reserved).

Finding ID
DTBI599-IE11
Rule ID
SV-59585r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI599-IE11 - MK Protocol - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to Enabled; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends configuring this setting to Enabled to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MK protocol must be enforced (Explorer).

Finding ID
DTBI600-IE11
Rule ID
SV-59587r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI600-IE11 - MK Protocol - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to Enabled; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to Enabled to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for MK protocol must be enforced (IExplore).

Finding ID
DTBI605-IE11
Rule ID
SV-59589r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI605-IE11 - MK Protocol - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to Enabled; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to Enabled to block the MK protocol unless specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Zone Elevation must be enforced (Reserved).

Finding ID
DTBI610-IE11
Rule ID
SV-59591r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI610-IE11 - Zone elevation - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Zone Elevation must be enforced (Explorer).

Finding ID
DTBI612-IE11
Rule ID
SV-59593r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI612-IE11 - Zone Elevation - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends configuring this setting as Enabled in all environments.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Zone Elevation must be enforced (IExplore).

Finding ID
DTBI614-IE11
Rule ID
SV-59595r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI614-IE11 - Zone elevation - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Restrict File Download must be enforced (Reserved).

Finding ID
DTBI630-IE11
Rule ID
SV-59597r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI630-IE11 - File download processes - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Restrict File Download must be enforced (Explorer).

Finding ID
DTBI635-IE11
Rule ID
SV-59645r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI635-IE11 - File download processes - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Restrict File Download must be enforced (IExplore).

Finding ID
DTBI640-IE11
Rule ID
SV-59647r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI640-IE11 - File download processes - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved).

Finding ID
DTBI645-IE11
Rule ID
SV-59653r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI645-IE11 - Restricting Pop Up Windows - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force the user to interact with a window containing malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows, and windows that hide other windows. Recommend configuring this setting to Enabled to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer).

Finding ID
DTBI647-IE11
Rule ID
SV-59655r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI647-IE11 - Internet Explorer Processes for restrict
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends configuring this setting to Enabled to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for restricting pop-up windows must be enforced (IExplore).

Finding ID
DTBI649-IE11
Rule ID
SV-59657r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI649-IE11 - Restricting Pop Up windows - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends configuring this setting to Enabled to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone).

Finding ID
DTBI650-IE11
Rule ID
SV-59663r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI650-IE11 - .NET w/Authenticode unsigned-Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether .NET Framework reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components not signed with Authenticode" to "Enabled", and select "Disable" from the drop-down box.

Check Content

RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

.NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone).

Finding ID
DTBI655-IE11
Rule ID
SV-59665r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI655-IE11 - .NET w/Authenticode signed - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether .NET Framework reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious content hosted on a website to take advantage of these components. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Run .NET Framework-reliant components signed with Authenticode" to "Enabled", and select "Disable" from the drop-down box.

Check Content

RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Scripting of Java applets must be disallowed (Restricted Sites zone).

Finding ID
DTBI670-IE11
Rule ID
SV-59667r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI670-IE11 - Scripting of Java applets - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Scripting of Java applets" to "Enabled", and select "Disable" from the drop-down box.

Check Content

ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

The URL to be displayed for checking updates to Internet Explorer and Internet Tools must be about:blank.

Finding ID
DTBI675-IE11
Rule ID
SV-59669r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI675-IE11 - Displaying URL's for update checking
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. If you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. The URL must be specified to be displayed for checking updates to Internet Explorer and Internet Tools. If you disable or do not configure this policy setting, users will be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Prevent changing the URL for checking updates to Internet Explorer and Internet Tools" to "Enabled" with a "blank or empty" selection box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The update check interval must be configured and set to 30 days.

Finding ID
DTBI680-IE11
Rule ID
SV-59671r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI680-IE11 - Update check interval
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Although Microsoft thoroughly tests all patches and service packs before they are published, organizations should carefully control all of the software that is installed on their managed computers. This setting specifies the update check interval, automatic installation, and the default interval value, which is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval, and computers will not automatically download and install updates for Internet Explorer. The update check interval must be specified. If you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Prevent specifying the update check interval (in days)" to "Enabled", and select "30" from the drop-down box.

Check Content

TurnOffConfiguringUpdateCheckInterval_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Ability for users to enable or disable add-ons must be enforced.

Finding ID
DTBI697-IE11
Rule ID
SV-59675r1_rule
Severity
Cat III
CCE
(None)
Group Title
DTBI697-IE11 - IE - Users enable or disable add-ons
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users often choose to install add-ons that are not permitted by an organization's security policy. Such add-ons can pose a significant security and privacy risk to your network. This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager. If you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on. If you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> "Do Not Allow users to enable or disable add-ons" to "Disabled" or "Not Configured".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Crash Detection management must be enforced.

Finding ID
DTBI715-IE11
Rule ID
SV-59677r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI715-IE11 - Crash Detection
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The "Turn off Crash Detection" policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from the computer's memory. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier, where Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Crash Detection" to "Enabled".

Check Content

TurnOffCrashDetection_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Managing SmartScreen Filter use must be enforced.

Finding ID
DTBI740-IE11
Rule ID
SV-59685r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI740-IE11 - Managing SmartScreen Filter
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious websites. This policy setting allows users to enable the SmartScreen Filter, which will warn if the website being visited is known for fraudulent attempts to gather personal information through "phishing" or is known to host malware. If you enable this setting the user will not be prompted to enable the SmartScreen Filter. It must be specified which mode the SmartScreen Filter uses: On or Off. If the feature is On, all website addresses not contained on the filters allow list, will be sent automatically to Microsoft without prompting the user. If this feature is set to Off, the feature will not run. If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> " Prevent Managing SmartScreen Filter" to "Enabled", and select "Off" from the drop-down box.

Check Content

TurnoffManagingSmartScreenFilter_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Add-on performance notifications must be disallowed.

Finding ID
DTBI745-IE11
Rule ID
SV-59687r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI745-IE11 - Add-on performance notifications disallowed
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting prevents Internet Explorer from displaying a notification when the average time it takes to load all the user's enabled add-ons exceeds the threshold. The notification informs the user that add-ons are slowing their browsing and displays a button which opens the Disable Add-ons dialog box. The Disable Add-ons dialog box displays the load time for each group of add-ons enabled in the browser. It allows the user to disable add-ons and configure the threshold. If you enable this policy setting, users will not be notified when the average time it takes to load all the user's enabled add-ons exceeds the threshold.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> "Turn off add-on performance notifications" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Updates to website lists from Microsoft must be disallowed.

Finding ID
DTBI750-IE11
Rule ID
SV-59689r1_rule
Severity
Cat III
CCE
(None)
Group Title
DTBI750-IE11 - Microsoft web site list updates
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy controls the website compatibility lists provided by Microsoft. If you enable this policy setting, the compatibility website lists provided by Microsoft will be used during browser navigation. If a user visits a site on the compatibility list provided by Microsoft, the page will automatically display in Compatibility view. If you disable this policy setting, the Microsoft website list will not be used. Additionally, users cannot enable the feature using the Compatibility View Settings dialog box. If you do not configure this setting, the Microsoft website list will not be active. The user can enable the functionality using the Compatibility View Settings dialog box.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Compatibility View -> "Include updated Web site lists from Microsoft" to "Disabled".

Check Content

IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var

Potential Impact

May adversely impact system.

Responsibility

System Administrator

IA Controls

ECSC-1

Browser Geolocation functionality must be disallowed.

Finding ID
DTBI755-IE11
Rule ID
SV-59691r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI755-IE11 - Browser Geolocation Functionality
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting has a small impact on user privacy because users may unknowingly allow their browser to share location data with web sites that they visit. The value of enabling this setting is diminished due to the fact that malicious web sites can learn a great deal about the location of a user merely by analyzing their IP address. If you enable this policy setting, browser geolocation support will be turned off. If you disable this policy setting, browser geolocation will be turned on. If you do not configure this setting, browser geolocation support can be turned on or off in Internet Options on the Privacy Tab.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off Browser Geolocation" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Browser must retain history on exit.

Finding ID
DTBI760-IE11
Rule ID
SV-59695r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI760-IE11 - Browsing History on exit
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious Web sites and files that could later be used for anti-virus and intrusion detection system (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> "Allow deleting browsing history on exit" to "Disabled".

Check Content

ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Suggested Sites functionality must be disallowed.

Finding ID
DTBI765-IE11
Rule ID
SV-59699r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI765-IE11 - Suggested Sites Functionality
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls the Suggested Sites feature, which recommends sites based on the user's browsing activity. Suggested Sites reports a user's browsing history to Microsoft to store and monitor user page activity to suggest sites the user might want to visit. If you enable this policy setting, the user will not be prompted to enable the Suggested Sites and the user's browsing activities will be sent and stored online to produce suggestions. If you disable this policy setting, the entry points and functionality associated with this feature will be disabled.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on Suggested Sites" to "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Deleting websites that the user has visited must be disallowed.

Finding ID
DTBI770-IE11
Rule ID
SV-59707r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI770-IE11 - Web site visit history
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks Delete. If you disable this policy setting, websites that the user has visited will be deleted when the user clicks Delete. If you do not configure this policy setting, the user will be able to select whether to delete or preserve websites the user visited when the user clicks Delete.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> "Prevent Deleting Web sites that the User has Visited" to "Enabled".

Check Content

PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Automatic checking for Internet Explorer updates must be disallowed.

Finding ID
DTBI775-IE11
Rule ID
SV-59711r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI775-IE11 - Internet Explorer Update Checking
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available. If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available. Newer versions might not comply with the Internet Explorer version requirements of the organization.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel-> Advanced Page-> "Automatically check for Internet Explorer updates" to "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

InPrivate Browsing must be disallowed.

Finding ID
DTBI780-IE11
Rule ID
SV-59713r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI780-IE11 - InPrivate Browsing
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data. If you enable this policy setting, InPrivate Browsing will be disabled. If you disable this policy setting, InPrivate Browsing will be available for use. If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> "Turn off InPrivate Browsing" to "Enabled".

Check Content

TurnOffInPrivateBrowsing_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone).

Finding ID
DTBI800-IE11
Rule ID
SV-59715r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI800-IE11 - Browser scripting control - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser control is allowed. If you disable this policy setting, script access to the WebBrowser control is not allowed. If you do not configure this policy setting, script access to the WebBrowser control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow scripting of Internet Explorer WebBrowser controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

ActiveX opt-in prompt must be disallowed.

Finding ID
DTBI805-IE11
Rule ID
SV-59717r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI805-IE11 - Opt-In Prompts for ActiveX
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Websites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an information bar will appear asking the user for approval. If you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks. If you disable or do not configure this policy setting the ActiveX opt-in prompt will appear.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn off ActiveX opt-in prompt" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

When uploading files to a server, the local directory path must be excluded (Internet zone).

Finding ID
DTBI810-IE11
Rule ID
SV-59719r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI810-IE11 - Local directory paths - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Include local path when user is uploading files to a server" to "Enabled", and select "Disable" from the drop-down box.

Check Content

IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Notification Bars must be enforced (Reserved).

Finding ID
DTBI815-IE11
Rule ID
SV-59723r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI815-IE11 - Notification Bar Process - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Security Warning for unsafe files must be set to prompt (Internet zone).

Finding ID
DTBI820-IE11
Rule ID
SV-59725r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI820-IE11 - Programs and unsafe files - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Show security warning for potentially unsafe files" to "Enabled", and select "Prompt" from the drop-down box.

Check Content

LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Notification Bars must be enforced (Explorer).

Finding ID
DTBI825-IE11
Rule ID
SV-59727r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI825-IE11 - Notification Bar Processes - Explorer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

ActiveX controls without prompt property must be used in approved domains only (Internet zone).

Finding ID
DTBI830-IE11
Rule ID
SV-59729r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI830-IE11 - ActiveX controls no prompt - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Allow only approved domains to use ActiveX controls without prompt" to "Enabled", and select "Enable" from the drop-down box.

Check Content

OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes for Notification Bars must be enforced (IExplore).

Finding ID
DTBI835-IE11
Rule ID
SV-59735r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI835-IE11 - Notification Bar Processes - IExplore
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Cross-Site Scripting (XSS) Filter must be enforced (Internet zone).

Finding ID
DTBI840-IE11
Rule ID
SV-59745r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI840-IE11 - Cross-Site Scripting Filter - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Turn on Cross-Site Scripting (XSS) Filter" to "Enabled", and select "Enable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Scripting of Internet Explorer WebBrowser control must be disallowed (Restricted Sites zone).

Finding ID
DTBI850-IE11
Rule ID
SV-59749r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI850-IE11 - Browser scripting control - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser control is allowed. If you disable this policy setting, script access to the WebBrowser control is not allowed. If you do not configure this policy setting, script access to the WebBrowser control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow scripting of Internet Explorer WebBrowser controls" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).

Finding ID
DTBI860-IE11
Rule ID
SV-59751r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI860-IE11 - Local directory paths - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Include local path when user is uploading files to a server" to "Enabled", and select "Disable" from the drop-down box.

Check Content

IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Security Warning for unsafe files must be disallowed (Restricted Sites zone).

Finding ID
DTBI870-IE11
Rule ID
SV-59755r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI870-IE11 - Programs and unsafe files - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Show security warning for potentially unsafe files" to "Enabled", and select "Disable" from the drop-down box.

Check Content

LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone).

Finding ID
DTBI880-IE11
Rule ID
SV-59759r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI880-IE11 - ActiveX controls no prompt - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Allow only approved domains to use ActiveX controls without prompt" to "Enabled", and select "Enable" from the drop-down box.

Check Content

OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Cross-Site Scripting (XSS) Filter property must be enforced (Restricted Sites zone).

Finding ID
DTBI890-IE11
Rule ID
SV-59761r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI890-IE11 - Cross-Site Scripting Filter - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> "Turn on Cross-Site Scripting (XSS) Filter" to "Enabled", and select "Enable" from the drop-down box.

Check Content

TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved).

Finding ID
DTBI900-IE11
Rule ID
SV-59763r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI900-IE11 - Restrict ActiveX Install - Reserved
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> "Internet Explorer Processes" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Status bar updates via script must be disallowed (Internet zone).

Finding ID
DTBI910-IE11
Rule ID
SV-59769r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI910-IE11 - Status bar updates via script - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone "Allow updates to status bar via script" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone).

Finding ID
DTBI920-IE11
Rule ID
SV-59773r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI920-IE11 - .NET w/Authenticode unsigned - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone "Run .NET Framework-reliant components not signed with Authenticode" to "Enabled", and select "Disable" from the drop-down box.

Check Content

RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

.NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone).

Finding ID
DTBI930-IE11
Rule ID
SV-59787r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI930-IE11 - .NET w/Authenticode signed - Internet
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will not execute signed managed components.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone "Run .NET Framework-reliant components signed with Authenticode" to "Enabled", and select "Disable" from the drop-down box.

Check Content

RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Scriptlets must be disallowed (Restricted Sites zone).

Finding ID
DTBI940-IE11
Rule ID
SV-59793r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI940-IE11 - Scriptlets - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone "Allow Scriptlets" to "Enabled", and select "Disable" from the drop-down box.

Check Content

AllowScriptlets_RestrictedSitesZone_LocalComputer_var

Responsibility

System Administrator

IA Controls

ECSC-1

Status bar updates via script must be disallowed (Restricted Sites zone).

Finding ID
DTBI950-IE11
Rule ID
SV-59805r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI950-IE11 - Status bar update by script - Restricted
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone "Allow updates to status bar via script" to "Enabled", and select "Disable" from the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Ability to install new versions of Internet Explorer automatically must be disallowed.

Finding ID
DTBI980-IE11
Rule ID
SV-59809r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI980-IE11 - Internet Explorer Automatic Updates
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting configures Internet Explorer to automatically install new versions of Internet Explorer when they are available. If you enable this policy setting, automatic upgrade of Internet Explorer will be turned on. If you disable this policy setting, automatic upgrade of Internet Explorer will be turned off. If you do not configure this policy, users can turn on or off automatic updates.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer "Install new versions of Internet Explorer automatically" to "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

When enhanced protected mode is enabled, ActiveX controls must be disallowed to run in protected mode.

Finding ID
DTBI985-IE11
Rule ID
SV-59841r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI985-IE11 - ActiveX controls in enhanced protected mode
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page "Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Dragging of content from different domains across windows must be disallowed (Internet zone).

Finding ID
DTBI990-IE11
Rule ID
SV-59847r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI990-IE11 - Content from different domains across windows - Internet zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone "Enable dragging of content from different domains across windows" to "Enabled", and select "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Enhanced protected mode functionality must be enforced.

Finding ID
DTBI995-IE11
Rule ID
SV-59853r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI995-IE11 - Enhanced Protected Mode
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode. If you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista. If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page "Turn on Enhanced Protected Mode" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Microsoft services to provide enhanced suggestions as the user types in the Address bar must be disallowed.

Finding ID
DTBI766-IE11
Rule ID
SV-59855r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI766-IE11 - Enhanced suggestions disallowed
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting allows Internet Explorer to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user's keystrokes are sent to Microsoft through Microsoft services.If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won't be able to change the Suggestions setting on the Settings charm.If you disable this policy setting, users won't receive enhanced suggestions while typing in the Address bar. In addition, users won't be able to change the Suggestions setting on the Settings charm.If you don't configure this policy setting, users can change the Suggestions setting on the Settings charm.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> "Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar" to "Disabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on.

Finding ID
DTBI356-IE11
Rule ID
SV-59861r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI356-IE11 - 64 bit tab processes must be turned on.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used.If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Advanced Page "Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows" to "Enabled".

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Antimalware programs against ActiveX controls must be run for the Internet zone.

Finding ID
DTBI1046-IE11
Rule ID
SV-59863r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1046-IE11 - Antimalware against ActiveX must be run for Internet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Security Page-> Internet Zone "Don't run antimalware programs against ActiveX controls" to Enabled" and select "Disable" in the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Antimalware programs against ActiveX controls must be run for the Intranett zone.

Finding ID
DTBI062-IE11
Rule ID
SV-59865r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI062-IE11 - Antimalware against ActiveX must be run for Intranet Zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Security Page-> Intranet Zone "Don't run antimalware programs against ActiveX controls" to Enabled" and select "Disable" in the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Antimalware programs against ActiveX controls must be run for the Local Machine zone.

Finding ID
DTBI426-IE11
Rule ID
SV-59869r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI426-IE11 - Antimalware against ActiveX must be run for Local Machine zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings..

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Security Page-> Local Machine Zone "Don't run antimalware programs against ActiveX controls" to Enabled" and select "Disable" in the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Antimalware programs against ActiveX controls must be run for the Restricted Sites zone.

Finding ID
DTBI1051-IE11
Rule ID
SV-59871r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI1051-IE11 - Antimalware against ActiveX must be run for Restricted Sites zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings..

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Security Page-> Restricted Sites Zone "Don't run antimalware programs against ActiveX controls" to Enabled" and select "Disable" in the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1

Antimalware programs against ActiveX controls must be run for the Trusted Sites zone.

Finding ID
DTBI092-IE11
Rule ID
SV-59875r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTBI092-IE11 - Antimalware against ActiveX must be run for Trusted Sites zone
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel->Security Page-> Trusted Sites Zone "Don't run antimalware programs against ActiveX controls" to Enabled" and select "Disable" in the drop-down box.

Check Content

Responsibility

System Administrator

IA Controls

ECSC-1